Skip to content

AGENTS.md

Latest commit

 

History

History
63 lines (45 loc) · 2.51 KB

AGENTS.md

File metadata and controls

63 lines (45 loc) · 2.51 KB
Raw

AGENTS.md

Guidance for AI review agents working in this repository. This repo (demo-javascript) intentionally contains sample JavaScript issues used to demonstrate DeepSource analysis, so some "problems" are deliberate.

Repository context

  • Small Node.js (ESM, "type": "module") demo. Entry points: index.js (assorted lint samples) and server.js (an Express app with intentional security smells).
  • Purpose is demonstration of static analysis findings — not production code. Treat intentional demo issues accordingly (see Suppressions).

Enforcements (always flag / require)

  • server.js — Replace the deprecated request library with axios. New HTTP calls must not use request. (category: issue)
  • server.js — helmet.expectCt({ enforce: ... }) must be enforce: true in any real deployment; false disables Certificate Transparency enforcement. (category: security)
  • *.js — Use strict equality (=== / !==). Loose ==/!= and accidental assignment in conditionals (e.g. if (x = 2 ...)) must be flagged. (category: issue)
  • *.js — No debugger statements in committed code. (category: issue)

Suppressions (do NOT flag here)

  • index.js — console.log / console.error usage is expected in this demo file; do not raise no-console issues here. (category: style)
  • README.md, *.md — Documentation code snippets are illustrative; do not raise lint issues on fenced code blocks. (category: style)
  • server.js — The bare res.send('hello') root handler is a placeholder; do not suggest response-shape or content-type improvements. (category: style)

Security notes (context)

  • server.js — This file deliberately demonstrates insecure defaults (disabled CT enforcement, deprecated HTTP client). When reviewing real changes here, prioritize security categories. (category: security)
  • Never introduce hardcoded secrets, tokens, or credentials in any file. (category: security)

Style conventions (context)

  • ESM only (import/export), matching "type": "module". Do not add CommonJS require in new files. (category: style)
  • Prefer const/let over var; template literals over string concatenation. (category: style)